High severity8.8NVD Advisory· Published Mar 21, 2022· Updated Jun 17, 2026
CVE-2022-26183
CVE-2022-26183
Description
PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pnpmnpm | < 6.15.1 | 6.15.1 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/pnpm/pnpm/commit/04b7f60861ddee8331e50d70e193d1e701abeefbnvdPatchWEB
- www.sonarsource.com/blog/securing-developer-tools-package-managers/nvdExploitThird Party Advisory
- github.com/advisories/GHSA-9m87-6fj3-c5xhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-26183ghsaADVISORY
- github.com/pnpm/pnpm/releases/tag/v6.15.1nvdRelease NotesWEB
- www.sonarsource.com/blog/securing-developer-tools-package-managersghsaWEB
News mentions
0No linked articles in our index yet.